Cyber Security Roadmap 2026
6 phases · 16 weeks · build one project in every phase.
Step-by-step plan
- TCP/IP and OSI model
- Linux command line
- Windows administration basics
- CIA triad and risk
- Common attack types
Project: Set up a home lab with Windows and Linux VMs and document the network diagram.
- Firewalls and segmentation
- IDS and IPS
- Wireshark and Nmap
- TLS and certificates
- Hashing and encryption
Project: Capture and analyse lab traffic, then harden a server's firewall and TLS settings.
- Log collection and parsing
- Windows events and Sysmon
- Splunk SPL and KQL
- Alert triage
- Phishing analysis
- Sigma rules
Project: Forward lab logs to a SIEM and build five detections with a triage dashboard.
- NIST incident lifecycle
- Containment strategies
- Memory forensics
- Disk imaging
- Incident reporting
Project: Simulate a malware infection in the lab and write a full incident report with timeline.
- MFA and conditional access
- Active Directory security
- Cloud IAM policies
- CSPM and cloud logging
- Container security
Project: Secure a free-tier cloud account with guardrails, logging and a CIS benchmark scan.
- ISO 27001 and NIST CSF
- Risk registers
- DPDP Act basics
- Interview practice
- Security+ or CySA+ preparation
Project: Build a risk register and policy set for a fictional startup and present findings.
Practise each topic
Frequently asked questions
How long does it take to learn Cyber Security?
Following this roadmap takes about 16 weeks with regular practice. Working professionals usually need a little longer.
What should I learn first in Cyber Security?
Start with phase 1: TCP/IP and OSI model, Linux command line, Windows administration basics. Build the phase project before moving on.
How do I know I am job-ready in Cyber Security?
When you can finish all phase projects on your own, solve the medium questions in the topic sheets and clear the mock interview comfortably.